Reseed demo tenants after each SSO login.

Demo Free/Pro/Enterprise accounts wipe and reload sample data on
authorization-code SSO callbacks so every sales walkthrough starts clean.

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -55,6 +55,10 @@ AFIA_ENABLED=true
 # Platform events webhook (user/org lifecycle from the monolith)
 SERVICE_EVENTS_INBOUND_SECRET=
 
+# Suite demo accounts (sales walkthroughs) — reset Frontdesk data on each SSO login
+DEMO_ACCOUNTS_ENABLED=false
+DEMO_RESET_ON_LOGIN=true
+
 # --- Inbound service API keys (sibling Ladill apps calling Frontdesk) ---
 FRONTDESK_API_KEY_POS=
 FRONTDESK_API_KEY_CRM=

app/Http/Controllers/Auth/SsoLoginController.php

@@ -123,6 +123,7 @@ class SsoLoginController extends Controller
         $request->session()->forget('sso.attempts');
 
         app(TeamMemberProvisioner::class)->sync($user);
+        app(\App\Services\Frontdesk\DemoLoginReseeder::class)->maybeResetAfterLogin($user);
 
         return $this->finishCallback($request, $intended, null, app(IdentityTeamClient::class));
     }

app/Services/Frontdesk/DemoLoginReseeder.php

@@ -0,0 +1,86 @@
+<?php
+
+namespace App\Services\Frontdesk;
+
+use App\Models\User;
+use Illuminate\Support\Facades\Artisan;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Reseed Frontdesk demo tenants after a fresh SSO login.
+ */
+class DemoLoginReseeder
+{
+    public function maybeResetAfterLogin(User $user): void
+    {
+        if (! (bool) config('demo_accounts.enabled', false)
+            || ! (bool) config('demo_accounts.reset_on_login', true)) {
+            return;
+        }
+
+        $plan = $this->planForEmail($user->email);
+        if ($plan === null) {
+            return;
+        }
+
+        $seedUser = $this->resolveSeedUser($user);
+        if (! $seedUser) {
+            return;
+        }
+
+        $lockKey = 'demo-reseed:frontdesk:'.$seedUser->public_id;
+        if (! Cache::add($lockKey, 1, 120)) {
+            return;
+        }
+
+        $identity = (string) ($seedUser->email ?: $seedUser->public_id);
+
+        dispatch(function () use ($identity, $plan, $lockKey) {
+            try {
+                Artisan::call('demo:seed', [
+                    'identity' => $identity,
+                    '--plan' => $plan,
+                    '--reset' => true,
+                ]);
+            } catch (\Throwable $e) {
+                Log::warning('demo_frontdesk_login_reseed_failed', [
+                    'identity' => $identity,
+                    'plan' => $plan,
+                    'error' => $e->getMessage(),
+                ]);
+            } finally {
+                Cache::forget($lockKey);
+            }
+        })->afterResponse();
+    }
+
+    private function planForEmail(?string $email): ?string
+    {
+        $email = strtolower(trim((string) $email));
+        if ($email === '') {
+            return null;
+        }
+
+        $accounts = (array) config('demo_accounts.accounts', []);
+        if (isset($accounts[$email])) {
+            return $accounts[$email];
+        }
+
+        $members = (array) config('demo_accounts.member_emails', []);
+        $ownerEmail = $members[$email] ?? null;
+
+        return $ownerEmail ? ($accounts[$ownerEmail] ?? null) : null;
+    }
+
+    private function resolveSeedUser(User $user): ?User
+    {
+        $email = strtolower((string) $user->email);
+        $ownerEmail = ((array) config('demo_accounts.member_emails', []))[$email] ?? null;
+        if (! $ownerEmail) {
+            return $user;
+        }
+
+        return User::query()->where('email', $ownerEmail)->first() ?? $user;
+    }
+}

config/demo_accounts.php

@@ -0,0 +1,18 @@
+<?php
+
+return [
+    'enabled' => (bool) env('DEMO_ACCOUNTS_ENABLED', false),
+    'reset_on_login' => (bool) env('DEMO_RESET_ON_LOGIN', true),
+
+    'accounts' => [
+        'demo-free@ladill.com' => 'free',
+        'demo-pro@ladill.com' => 'pro',
+        'demo-enterprise@ladill.com' => 'enterprise',
+    ],
+
+    // Org members share the enterprise owner tenant.
+    'member_emails' => [
+        'demo-enterprise-member-1@ladill.com' => 'demo-enterprise@ladill.com',
+        'demo-enterprise-member-2@ladill.com' => 'demo-enterprise@ladill.com',
+    ],
+];

tests/Feature/DemoLoginReseederTest.php

@@ -0,0 +1,83 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use App\Services\Frontdesk\DemoLoginReseeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Artisan;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Str;
+use Tests\TestCase;
+
+class DemoLoginReseederTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_reseeds_demo_free_account_via_artisan_after_login(): void
+    {
+        config([
+            'demo_accounts.enabled' => true,
+            'demo_accounts.reset_on_login' => true,
+        ]);
+
+        $user = User::create([
+            'public_id' => (string) Str::uuid(),
+            'name' => 'Demo Free',
+            'email' => 'demo-free@ladill.com',
+        ]);
+
+        Artisan::shouldReceive('call')
+            ->once()
+            ->withArgs(function (string $command, array $params): bool {
+                return $command === 'demo:seed'
+                    && $params['identity'] === 'demo-free@ladill.com'
+                    && $params['--plan'] === 'free'
+                    && $params['--reset'] === true;
+            })
+            ->andReturn(0);
+
+        app(DemoLoginReseeder::class)->maybeResetAfterLogin($user);
+        $this->app->terminate();
+
+        $this->assertFalse(Cache::has('demo-reseed:frontdesk:'.$user->public_id));
+    }
+
+    public function test_skips_when_demo_accounts_disabled(): void
+    {
+        config([
+            'demo_accounts.enabled' => false,
+            'demo_accounts.reset_on_login' => true,
+        ]);
+
+        $user = User::create([
+            'public_id' => (string) Str::uuid(),
+            'name' => 'Demo Free',
+            'email' => 'demo-free@ladill.com',
+        ]);
+
+        Artisan::shouldReceive('call')->never();
+
+        app(DemoLoginReseeder::class)->maybeResetAfterLogin($user);
+        $this->app->terminate();
+    }
+
+    public function test_skips_non_demo_emails(): void
+    {
+        config([
+            'demo_accounts.enabled' => true,
+            'demo_accounts.reset_on_login' => true,
+        ]);
+
+        $user = User::create([
+            'public_id' => (string) Str::uuid(),
+            'name' => 'Regular User',
+            'email' => 'regular@example.com',
+        ]);
+
+        Artisan::shouldReceive('call')->never();
+
+        app(DemoLoginReseeder::class)->maybeResetAfterLogin($user);
+        $this->app->terminate();
+    }
+}